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ABSTRACT 


The  use  of  retinal  biometric  identifiers  as  security 
devices  in  shipboard  applications  was  investigated  with  the 
use  of  the  DOT  7.5(new  version)  and  DAISY  7.  5( old  version) 
scanners  of  the  Eye-Dentify  Co.  of  Beaverton,  Oregon.  Motion 
testing  was  the  primary  purpose  of  the  thesis.  It  was  the 
first  occurance  of  dynamic  testing  on  any  type  of  retinal 
pattern  recognition  device.  A  transverse  motion(only) 
simulator  that  could  roll  up  to  fourteen  degrees  and  sustain 
a  cycle  per  minute(cpm)  rate  of  6.0  was  constructed  and 
utilized.  The  nature  of  the  experiment  was  to  test  the  two 
scanners  to  determine  if  there  would  be  significant 
differences  in  the  characteristics  of  the  two,  and  their 
possible  uses  at  sea.  Important  conclusions  were:  1)  The 
best  results  occured  on  the  DOT  7.5,  although  five  Type  II 
'RECOGNITION'  errors  were  noted;  2)  As  period  of  roll  and 
angle  of  roll  were  increased  in  cpm's  and  degrees 
respectfully,  results  were  poorer;  3)  Identification 
threshold  settings  were  allowed  to  be  set  too  low  at  +0. 60 
by  the  CRT  lock  manager,  and  should  be  raised  to 
approximately  +0. 70.  That  way,  the  probability  of  the 
occurance  of  Type  II  errors  (false 
RECOGNITIONS/VERIFICATIONS)  would  be  greatly  decreased;  4) 
Retinal  scanners  are  generally,  very  reliable. 
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I.   INTRODUCTION 

The  control  of  access  to  computer  systems  and  other 
vital  equipment  is  becoming  increasingly  important  as  they 
are  entrusted  with  more  sensitive  applications  and  more 
valuable  information.  Much  emphasis  has  been  placed  in 
increasing  the  accessibility  of  this  equipment  in  order  to 
accommodate  the  user  and  to  enhance  his  ability  to  interact 
with  it.  This  has  posed  new  threats  to  system  security  and 
has  emphasized  the  need  for  more  adequate  safeguards  against 
unauthorized  access  ( FIPS  Pub  48,  1977,  p. 7).  Aboard 
present  Naval  and  Coast  Guard  vessels  ,  passwords,  cipher 
combinations,  armed  Marine  guards  for  access  to  surface  Navy 
nuclear  propulsion  spaces,  I.D.  cards  etc.  are  the 
safeguards  utilized  to  protect  this  equipment  and  space. 
Should  there  be  more  of  the  same  or  should  government  direct 
future  planning  towards  replacing  some  of  these  basic 
methods  with  newer  technology. 

There  are  three  methods  by  which  a  person's  identity  may 
be  established:  1.  something  a  person  KNOWS  like  a  password 
2.  something  that  he  POSSESSES  like  an  identification 
photograph,  I.D.  card  etc.  and  3.  something  physically  ABOUT 
that  person  such  as  height,  weight,  and  fingerprints. 
Others  include  hand  geometry,  voice  patterns,  finger  length, 
and  blood  vessel  patterns  posterior  to  the  retina. 

Although  weight  can  be  useful  in  identifying  someone,  it 
is  not  as  reliable  as  other  physiological  traits  because  the 
individual  has  the  ability  to  change  it  through  gain  or 
loss.  An  unchanging  unique  identifier  that  no  two  subjects 
can  identically  possess,  is  most  reliable  when  it  comes  to 
'ABSOLUTE  identification'.  This  compared  to  VERIFICATION  of 
non-physiological  items  like  passwords   that  are  SUPPLIED  by 
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the  subject  attempting  to  gain  access.  Because  of  the 
vulnerability  that  the  first  two  methods  of  identification 
have  to  threats  such  as  theft  and  duplication,  much  emphasis 
is  presently  being  focused  on  the  technology  of  personal 
identification  through  physiological  and  morphological 
attributes( Rennick  ,  1975).  Morphology  is  the  study  of  the 
form  and  structure  of  an  organism  or  any  of  its  parts. 
Method  three  utilizes  this  technology. 


The  scope  of  this  thesis  was  to  determine  if  the 
installation  of  retinal  biometric  devices  to  assist  in 
protecting  vital  areas  is  feasible  in  a  shipboard 
environment.  Two  models  of  the  Eye  Dentify  7. 5  retinal 
scanner  by  Eye  Dentify  Inc.  Beaverton,  Oregon  were  utilized 
during  experimentation.  See  Figure  1.  1  to  view  the  DAISY 
7. 5  retinal  scanner.  Figures  2. 2  and  2.  3  display  the  newer 
version  DOT  7. 5  that  has  recessed  eyeports.  A  transverse 
motion  simulator  with  variable  speeds  and  angle  of  roll  up 
to  fourteen  degrees  was  used  to  simulate  vessel  motion. 


Figure  1.1  Eye  Dentify  Inc.  DAISY  7.5  Scanner 


II.   THE  EXPERIMENT 


A.   EQUIPMENT 

The  Eye-dentify  machine  is  based  on  the  concept  of 
biometrics,  the  application  of  mathematical-statistical 
theory  to  biology.  The  7. 5  scanner  utilizes  the  retinal 
patterns  of  humans  as  the  unique  identifier.  This  identifier 
is  needed  to  disseminate  between  subjects  trying  to  gain 
access  to  a  security  area  via  the  7. 5.  A  study  by  Dr. 
Carleton  SIMON  and  Dr.   Isadore  GOLDSTEIN  concluded  that, 

the   spatial   patterns   exhibited  by  the   internal   blood 
vessels  of  the   human   eye  are   a  highly   stable  ,  highly 
deterministic     source     of    biometric    information. 
(Goldstein,  Simon,  1935) 

Through  the  efforts  of  Dr.  Paul  Tower(1955),  these  prior 
findings  were  enhanced  by  his  study  that  showed  that  the 
greatest  dissimilarities  between  monozygotic( identical ) 
twins,  was  in  the  retinal  blood  vessel  patterns. 

The  hardware  components  for  the  two  7.5's  include  a 
binocular  eyepiece  for  the  DAISY  and  a  recessed 
monocular( right  eye)  eyeport  for  the  DOT.  This  difference 
is  the  only  one  between  these  scanners.  Other  components  are 
LED  display,  cast  aluminum  housing,  12  digit  keypad(0-9,  # 
*),  SCAN  button,  internal  68000  microcomputer  chip  and 
electronic  camera.  The  weight  of  a  7.5  is  approximately  26 
pounds.  External  to  the  scanner  is  a  system  compatible 
terminal  for  I/O  interface.  A  printer  option  was  available 
through  an  auxiliary  port.  A  640K(RAM)  microcomputer  was 
used  to  'download'  data  to  floppy  disk  as  a  'backup'  or 
'upload'  to  the  7.5. 

The  Eye-dentify  7. 5  has  internal  software  that  controls 
the  system's   operation,   and  operation  of   external  devices 
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and  IBANK  storage  for   the  signature  templates  corresponding 
to  those  human  eye  patterns  that  have  been  enrolled. 
1.   I CAM  Camera 

The  I CAM( camera)  scans/illuminates  a  fovea  centered 
circle,  on  the  inside  posterior  section  of  the  eye  which 
includes  the  retina  and  choroid.  The  retina,  continuous  with 
the  optic  nerve,  is  that  part  of  the  eye  that  receives  the 
image  produced  by  the  crystalline  lens.  The  optic  nerve 
conducts  impulses  from  the  retina  to  the  brain.  The  choroid 
is  a  delicate,  highly  vascular  layer  that  is  continuous  with 
the  iris( color  surrounding  the  pupil)  and  lies  between  the 
sclera(part  of  the  dense  external  covering  of  the  eyeball) 
and  the  retina( Webster ' s  Die,  1984).  The  scanned  circle  has 
a  0. 8  degree  radius  and  its  size,  expressed  as  an  external 
field  half  angle,  is  ten  degrees.  Infrared  light  is  the 
medium  used  in  illumination.  The  amount  emitted  is 
equivalent  to  the  portion  of  infrared  contained  in  the 
natural  light  shining  from  the  bulb  in  a  refrigerator.  This 
same  infrared  is  also  found  in  home  smoke  alarms  and  VCR 
remote  controls. 

The  light  that  is  reflected  off  the  blood  vessels, 
retina  and  choroid,  is  passed  through  a  photo  sensor.  It  is 
then  scattered  and  320  12-bit  measurements  are  captured 
along  a  450  degree,  (450/360=  1.25  rotation),  camera  lens 
scan.  An  analog  waveform  is  developed  and  then  digitized  via 
an  A/D( analog-digital )  converter.  The  digital  signal  is  then 
sent  to  the  microcomputer  chip  for  processing  and  then 
stored  in  IBANK  memory  as  a  320  bit  eye  signature  in  PIN 
verification  mode.  See  Figure  2.  1  for  an  illustration  of 
the  system  flow  diagram. 
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SYSTEM    FLOW    DIAGRAM 
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EYE  SIGNATURE  -  composite  of  live  ID  signals  acquired  during 
enrollment  process.   Each  eye  (left  and  right)  is  packed  into 
40  bytes  (320  bits)  for  storage  in  the  Ibank 

ICAM  -  acquires  and  digitizes  the  identification  pattern  from 
the  subject's  eye 

IBANK  -  Storage  of  all  Eye  Signatures  (reference  templates) 

PIN  -  Personal  Identification  Number.   Used  in  Verify  mode  to 
select  specific  Eye  Signature  for  match 

MODE  SWITCH  -  Selects  the  mode  of  the  7.5.   Enroll  mode  allows 

a  new  individual  to  be  added  to  the  Ibank.   Verify  compares 

a  live  eye  with  the  Eye  Signature  designated  by  the  PIN 

entry.   Recognition  automatically  selects  best  Eye  Signature 
from  the  Ibank 

Figure  2.1  System  Flow  Diagram, Extrac. ( Eye-Dentify  7.5,1984) 
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In  verification  mode  with  1200  eye  patterns  on  file, 
verification  would  take  about  1.5(15/10)  seconds.  Of  this 
time,  six  tenths(6/10)  of  a  second  is  for  rotational  delay 
as  the  ICAM  spins  the  450  degrees( 1. 25  rotations)  required 
in  the  scanning  process.  The  remaining  nine  tenths  (9/10)  of 
a  second  is  for  processing  bits  in  the  microprocessor  that 
are  associated  with  the  specific  eye  signature  that  is  being 
compared  to  the  'live  eye'  just  scanned.  With  recognition 
mode,  the  time  required  for  individual  processing  depends  on 
the  number  of  templates  in  memory.  With  fifty  templates, 
response  time  is  approximately  two  seconds. 

2.    Recognition  Eye  Signature  Data  Structure 

The  eye  signature  data  structure  for  recognition 
mode  is  72  bytes  (576  bits).  Forty(40)  bytes  are  used  for 
verification  purposes,  thirty  two(32)  for  recognition.  The 
reason  for  this  diversification  is  SPEED  OF  RESPONSE. 
Whenever  scanning  in  recognition  mode,  whether  there  are 
fifty  or  twelve  hundred  templates  in  bubble  memory,  the  five 
closest  templates  to  the  'live  eye'  scanned  are  chosen  for 
further  comparisons.  An  algorithm  based  on  fourier  cross 
correlation  is  used  on  the  (32  byte)  recognize  templates. 
This  allows  for  the  fastest  possible  selection  of  the  five 
most  similar  templates.  The  corresponding  time  is  actually 
less  than  50  milliseconds  for  a  sample  of  100  subjects  in 
bubble  memory.  (Eye  Dent  letter,  Jan  86)  Next,  verification 
mode  procedures  are  implemented  on  the  chosen  five  to  select 
the  best  template  match  for  the  live  eye.  The  first 
verification  that  exceeds  the  threshold  requirements  is  the 
eye  that  is  considered  recognized.  The  match  is  then 
displayed  in  the  LED  window  and  on  a  printer  if  connected. 
This  explains  why  it  takes  longer  to  get  a  response  when 
scanning  in  the  recognition  mode.  Time  for  the  fast  fourier 
analysis  plus  the  time  for  5  verifications.  If  this  method 
was  not  available,  EACH  template  in  bubble  memory  would  have 
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to  be  compared  via  verification  methodology  against  the 
'live'  eye  pattern.  This  would  take  an  impractical  amount  of 
time.  For  example,  with  200  subjects  in  memory  and  no 
fourier  analysis,  it  would  take  ((9/10  sec/template) *( 200 
templates)=  3  minutes,  and  this  would  only  be  processing 
time. 

B.   THE  MOVING  PLATFORM 

A  moving  platform  was  constructed  to  test  how  both  the 
DOT  and  DAISY  Eye-Dentify  7. 5  would  perform  in  a  seaway. 
Transverse  roll  would  be  measured  with  the  use  of  a 
protractor  mounted  horizontally  and  a  plumb  line  hanging 
vertically.  The  platform  was  designed  to  roll  only  in  one 
dimension  due  to  money,  time  and  material  constraints. 
Therefore,  this  would  eliminate  the  other  sensations  of 
motion  that  any  individual  riding  aboard  a  vessel  at  sea 
would  encounter.  These  would  be  YAW,  angular  motion  about 
the  vertical  axis,  and  PITCH,  fore  and  aft  rotation  about 
the  Center  of  Floatation  lateral  axis.  The  testing  would  be 
done  at  rolls  of  seven  degrees  and  fourteen  degrees.  These 
were  chosen  as  being  representative  of  common  sea  states. 
The  mechanical  constructs  of  the  platform,  and  the  output 
power  of  the  electrical  motor  used  to  generate  motion, 
hampered  testing  at  angles  greater  than  this. 

The  time(sec)  from  port  to  starboard  to  port  was  also 
varied  on  the  moving  platform.  This  to  model  the  periodicity 
of  waves  as  they  pass  under  the  hull  of  a  ship  and  the 
resultant  cycle  times  ,also  known  as  Period  of  Roll  that 
occur. (Naval  Ships  Technical  Manual  079  VOL.1  -Stability  and 
Buoyancy,  1983)  The  height  of  a  wave  at  sea,  and  also  its 
length  in  feet  from  crest  to  crest  will  have  an  effect  on  a 
ship's  "ride".  To  capture  this  phenomenon,  a  permanently 
lubricated   ZERO-MAX   variable   drive  attached   to   a   three 
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quarter  horsepower,  sixty  hertz,  1725  rpm  electric  motor  was 
used.  This  variable  drive  was  rated  to  deliver  a  maximum  of 
100  inch-pounds  of  torque  to  its  output  shaft.  A  10: 1 
reduction  gear  was  connected  to  this  output  shaft  to  create 
the  desired  shaft  rotation  needed  to  rotate  the  10. 25  inch 
diameter  drive  wheel  that  the  19.  5  inch  drive  arm  was 
attached  to.  This  drive  arm,  that  was  connected  to  the 
platform,  required  lubrication  with  graphite  bearing  grease. 
Although  this  was  the  case,  there  were  two  instances  where 
bolts  used  to  connect  the  drive  rod  to  the  drive  wheel  did 
fail  under  load. 

To  insure  that  all  measurements  which  dealt  with  cycle 
time  were  noted  under  a  constant  regimen,  a  benchmark  scale 
located  atop  the  ZERO-MAX  was  utilized.  This  scale  had 
values  ranging  from  zero  to  six.  With  the  use  of  a  hand 
wheel  that  adjusted  the  ZERO-MAX,  a  setting  within  this 
range  could  be  established.  Simply,  a  direct  relationship 
between  the  benchmark  setting  and  the  cycle  time(sec) 
occured.  The  higher  the  setting,  the  faster  the  cycle  time. 
If  set  at  a  value  of  6,  the  cycle  time  in  seconds  was  very 
small  meaning  the  moving  platform  would  "snap"  back  and 
forth  from  port  to  starboard.  For  experimentation  purposes, 
Eye-Dentify  7. 5  scans  using  both  DOT  and  DAISY  machines  were 
taken  at  benchmark  values  of  1. 0  and  1. 5.  These  settings 
gave  respective  cycle  times  of  approximately  10  seconds  and 
20  seconds.  The  first  value  representative  of  a  turbulent 
sea  state  with  rough  seas,  the  second  a  more  moderate  , 
gentle  sea  state. 

The  platform  was  mounted  inside  a  rectangular  base  used 
for  structural  strength.  Two  plywood  mounting  braces  were 
installed  on  either  side  of  the  moving  platform.  One  was 
used  as  a  safety  step  for  students  to  mount  and  dismount  the 
platform,  the  other  as  a  mount  for  the  motor,  variable  drive 
and  reduction  gear.  The  platform  was  hex  bolt  pinned  forward 

15 


and  aft,  to  the  rectangular  base.  It  was  about  these  points, 
that  the  platform  would  rotate  transversely.  Subjects  were 
allowed  to  mount  and  dismount  only  from  the  right  side.  This 
way  they  would  have  no  interaction  with  any  of  the 
mechanical  devices.  A  chair  was  mounted  centrally  on  the 
plywood  platform  base.  Initially,  the  subjects  were  to  be 
tested  in  the  standing  position,  but  this  proved  to  be 
unrealistic.  At  faster  cycle  times,  they  were  unable  to 
safely  maintain  their  balance.  Also,  in  the  standing 
position,  their  weight  would  be  distributed  at  a  higher 
center  of  gravity  thereby  putting  undue  loads  on  the  slip 
belt  of  the  variable  drive,  which  inevitably  might  have  lead 
to  a  mechanical  failure.  See  Figure  2.2  below  and  2.3  on 
the  following  page  for  visual  description  of  the  platform 
and  the  DOT  7.  5  scanner. 


Figure  2. 2   The  Transverse  Motion  Simulator-Side 
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Figure  2. 3   The  Transverse  Motion  Simulator-Rear 

A  seatbelt  was  required  at  all  times  when  data 
collection  was  undertaken  for  safety  considerations.  The  7. 5 
was  mounted  at  a  height  of  40. 5  inches  above  the  platform  in 
compliance  with  prior  guidelines  determined  at  the  Sandia 
National  Laboratories,  Albuquerque,  New  Mexico,  in  June  1985 
( Maxwell, undated) .  This  height  allowed  the  least  amount  of 
stooping  when  eye  scanning  in  the  sitting  position.  The 
system  operator  controlled  the  electric  motor  via  a  remote 
switch,  and  would  instruct  each  person  in  the  operation  of 
both  the  DAISY  and  DOT  7. 5  prior  to  starting  the  motor. 
Because  each  subject  had  been  through  an  earlier  explanation 
during  initial  template  enrollment  ,  this  second  explanation 
only  had  to  be  done  once,  saving  much  time. 

Connected  to  the  auxiliary  port  of  the  Eye-Dentify  was 
an  Okidata  u93  serial  printer.  Output  displayed  on  the 
printer  was  subject's  PIN( personal  identification 
number ), identification  code,  which  can  be  any  letter  or 
number  , whether  the  person  (was/was  not) 
VERIFIED/RECOGNIZED,  correlation  score  and  the  date.  The  LED 
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display  of   either  machine   will  show  up   to  eight   of  these 
characters. 


C.   THE  OBJECTIVE 

The  objective  of  this  experiment  was  to  compute  Type  I 
and  Type  II  error  rates  when  subjects  were  tested  under 
dynamic  conditions  created  when  the  transverse  motion 
simulator  was  used.  The  recognition  and  verification 
thresholds  would  be  held  constant  at  +0. 60.  Results  from  an 
earlier  test  that  used  the  Range  Test  on  Means  method 
(Helle,1985)  indicated,  little  difference  in  findings 
between  the  lowest  possible  setting  of  +0. 60  and  the 
midpoint  setting  of  +0.  72.  Therefore,  +0.  60  was  chosen  to 
ascertain  how  each  retinal  biometric  scanner  would  perform 
under  the  least  stringent  threshold  setting. 

This  would  be  the  first  occurance  of  a  dynamic  test  on 
any  Eye-Dentify  7. 5.  All  earlier  tests  were  static.  As 
experimentation  proceeded,  results  showed  an  unusually  large 
occurance  of  Type  II  errors  with  the  DOT  7.5,  especially  in 
VERIFICATION  mode  to  specific  individuals.  Therefore,  an 
additional  objective  was  included,  to  determine  if  the 
accuracy  of  this  biometric  scanner  was  worse  than 
advertised. 

The  research  dealt  with  the  possible  use  of  these 
scanners  aboard  Coast  Guard  and  Naval  vessels  in  a  variety 
of  applications,  such  as  radio  and  crypto  spaces.  Other 
significant  potential  uses  at  sea  are  access  to  computers 
and  their  systems,  the  CMS (  communication  security  material 
system)  vault,  supply  office  cash  vault,  the  entrance  to 
nuclear  engineering  spaces,  and  activation  of  a  weapon 
launch.  Also  possible  is  communication  equipment  control  and 
security,  including  authentication  and  recognition. 
Additional  military  applications  might  include  strategic  and 
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tactical  command   control,   security   for,   or   part  of   the 
nuclear  missile  launch  sequence  at  our  silos. 

An  added  plus,  was  the  availability  of  the  newer  version 
DOT  7. 5  scanner  to  the  system  operator.  Not  only  could  the 
question  of  how  motion  affects  the  system  be  investigated, 
but  an  additional  objective  of  comparing  ease  of  use, 
accuracy,  and  the  number  of  Type  I  and  Type  II  errors  that 
occur  between  the  DOT  and  DAISY  be  scrutinized.  These 
objectives  were  made  as  specific  as  possible  to  create  an 
atmosphere  of  simplicity,  thoroughness  and  accuracy. 

D.   EXPERIMENTAL  PROCEDURE 

Sixteen  subjects  were  chosen  at  random  from  a  total  of 
approximately  sixty  students  that  were  enrolled  in  the  same 
MAN-MACHINE  INTERACTION  course  at  the  Naval  Postgraduate 
School.  Taking  this  specific  course  did  not  unfairly 
prepare  any  of  these  students  for  the  extensive 
experimentation  that  was  to  follow.  Three  females  and 
thirteen  males( 14  military,  2  civilian)  were  chosen  with  the 
use  of  a  random  number  generator.  Their  ages  ranged  from  a 
high  of  51  to  a  low  of  27.  Those  that  wore  contacts  were 
allowed  to  wear  them  during  the  analysis,  while  glasses  were 
not.  They  hampered  some  subjects  during  scanning.  None  of 
the  sixteen  stated  that  they  were  totally  or  partially  color 
blind.  During  the  initial  enrollment  process,  all  sixty 
OS3404  class  members,  became  the  template  database.  There 
were  instances  where  students  not  involved  with  the  motion 
testing  exhibited  either  slight  color  blindness  or  chronic 
stigmatism,  which  caused  trouble  when  trying  to  enroll  them 
into  the  DAISY  7.5.  This  was  not  the  case  with  the  DOT  7.5. 
None  of  the  sixty  had  ever  used  either  7. 5  system  before. 
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1.    The  Enrollment  Process 

To  implement  the  enrollment  process,  a  system 
compatible  CRT  (Cathode  Ray  Tube)  was  required  to  be 
connected  via  ribbon  cable  to  the  terminal  port  of  the  7. 5. 
Assuming  power  has  been  secured  to  the  system,  the  operator 
had  to  first  gain  access  to  the  software  main  menu.  This  was 
done  by  scanning  his  own  eye.  This  allows  access  because  the 
system  operator  was  listed  under  CRT  lock  management, 
another  name  for  database  management.  After  this  step, 
enrollment  may  be  initiated  by  typing  E  with  a  carriage 
return.  When  enrolling  a  person,  they  must  be  directed  to 
concentrate  because  very  low  correlation  scores  will  occur 
if  instructions  are  not  followed.  Below  are  the  guidelines 
to  follow  when  enrolling  ONLY  on  the  DAISY  wheel  scanner: 

1.  Square  the  head  up  to  the  binocular  eye  ports. 

2.  Look  into  the  eye  ports  and  concentrate  only  on  the 
center  of  the  daisy  design  to  the  upper  left.  Ignore 
the  second  one  you  see  to  the  lower  right.  The  left 
eye  port  is  blanked  off  and  it  slides  left  and  right 
to  provide  a  comfortable  fit.  Keep  both  eyes  open. 

3.  Move  your  head  about,  until  all  red  is  removed  from 
view  with  only  the  greenish-white  daisy  design 
remaining.  This  is  where  the  majority  of  problems 
occured  with  subjects  who  were  slightly  color  blind  to 
greens  or  reds. 

4.  Press  the  SCAN  button  on  the  front  of  the  machine  very 
gently.  Erroneous  data  can  occur  by  moving  the  machine 
when  pressing  too  hard  if  it  is  not  permanently 
mounted. 

The  following  are  guidelines  implemented  when  enrolling  ONLY 
on  the  DOT  scanner: 

1.  Square  the  head  up  to  the  machine  and  place  forehead 
on  headrest.  Notice  there  are  no  binocular  eye  ports, 
only  one  recessed  eye  port  for  the  right  eye.  The 
white  line  adjacent  to  this  eye  port  is  to  be  used 
optionally  to  align  the  center  of  the  right  pupil  to 
the  center  of  the  eye  port. 

2.  Once  on  the  headrest,  do  not  move  the  head  up  or  down, 
only  to  the  left  or  right  when  you  have  the  beam  of 
light  in  view.  You   will   perceive   depth  that  you  did 
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not  sense  when  using  the  DAISY.  Place  the  3  dots  of 
light  that  appear  atop  one  another  in  a  vertical  line. 
One  dot  will  now  appear.  Place  it  in  the  center  of  the 
outer  semi-circular  ring.  For  some,  the  dot  will  look 
as  if  it  is  the  apex  of  a  three  dimensional  cone.  The 
act  of  fixating  on  this  dot  or  the  center  of  the  daisy 
pattern  in  the  older  version  7. 5  centers  the  scan 
circle  on  the  fovea.  This  is  the  part  of  the  retina 
that  corresponds  to  the  center  of  vision. 

Press  the  SCAN  button  gently,  as  with  the  DAISY.  It  is 
also  located  in  the  same  position  mentioned  earlier. 


When  the  SCAN  button  is   depressed,   the  I CAM  camera 
is  activated  and  a  template  is  created  and  stored  in  memory. 
After  the  first  scan,  a  message  will  display  on  the  CRT.   At 
this  point  the  system  operator  has  three  choices: 

1.  Finish  enrollment    and   identify   PIN   (personal 
identification  number)  with  a  code. 

2.  Restart  the  Enrollment  Process  - 

retaining  only  the  previous  retinal  scan  as  the 
beginning  of  a  new  reference  template.  All 
previous  eye  signatures  accumulated  during  the 
enrollment  session  are  erased.  This  function  is 
useful  when  previous  correlation  scores  have  been 
low  and  the  enroller  wishes  to  restart  the 
enrollment  process.  ( Eye-Dentif ication  Inc.,  1985) 

3.  Cancel  the  current  session  altogether. 

To  acquire  OPTIMUM  memory  templates,  user  manual 
procedure  required  the  enroller  to  take  at  least  5  eye  scans 
where  the  average  correlation  score  of  the  entire  five  was 
+0. 90.  These  correlation  scores  appear  automatically  on  the 
CRT  display  terminal  and  they  can  be  ignored  or  averaged 
with  the  person's  template  stored  in  memory.  All  sixteen 
subjects  associated  with  the  moving  experiment  not  only  met 
this  requirement  but  were  able  to  be  enrolled  with  accepted 
correlation  scores  never  below  +0.90,  so  any  average  of  the 
five  scans  taken  would  be  well  above  +0. 90.  A  correlation 
score  is  the  mathematical  representation  computed  by  the 
68000  microprocessor  that  defines  how  similar  that  live  eye 
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scan  just  processed  is  to   the  person's  most  recent  template 
in  Ibank  memory. 

2.    Factors  Tested 

When  testing  began  using  the  transverse  motion 
simulator,  the  sixteen  subjects  were  told  to  report  during 
announced  times.  They  would  have  to  report  eight  separate 
times  with  at  least  a  one  hour  delay  between  tests,  for 
learning  curve  purposes.  The  commencement  date  was  08 
November  1985  with  completion  of  all  phases  of  the 
experiment  occuring  on  27  November  1985.  Both  the  drive  arm 
linkage,  DAISY  and  DOT  machines  had  to  be  changed  and 
adjusted  manually  for  the  duration  of  the  experiment,  which 
is  one  reason  for  such  an  expanded  time  frame.  The  drive  arm 
procedure  in  particular,  was  considerably  time  consuming. 
On  the  drive  wheel,  were  drilled  7/16  inch  threaded  holes 
outward  from  its  center  in  the  form  of  an  arc,  through  which 
the  connecting  7/16  inch  bolt  would  pass  through.  Here,  the 
drive  wheel  and  drive  arm  were  attached.  The  bolt  would  have 
to  be  moved  to  a  new  hole  along  the  arc,  whenever  a  change 
in  angle  of  roll  was  required  in  the  analysis.  Criteria  for 
experimentation  required  the  machines  to  be  scrutinized 
under  the  same  conditions,  chosen  on  a  random  basis.  These 
FACTORS  are  listed  below: 

1.  DAISY  Scanner 

2.  DOT  Scanner 

3.  Angle  of  roll   7  degrees 

4.  Angle  of  roll  14  degrees 

5.  Cycle  time  of  10  seconds  corresponding  to  a  setting  of 
1. 5  on  ZERO-MAX  scale. 

6.  Cycle  time  of  20  seconds  corresponding  to  a  setting  of 
1. 0  on  ZERO-MAX  scale 

A  successful   recognize  was  represented  by   a  Y(YES) 
in  the  system  operator's  log  sheet.    For  this  to  happen,   a 
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subject  would  have  to  receive  a  correlation  score  equal  to 
+0. 60  or  higher  with  their  personal  identification  number 
(PIN)  and  identification  code  correctly  identified.  If  the 
statement  NOT  RECOGNIZED  were  to  appear,  it  would  mean  their 
correlation  score  was  lower  than  +0. 60.  In  this  instance,  no 
PIN  or  identification  code  is  printed,  only  the  correlation 
score  and  date  appear.  As  noted  earlier,  if  this  were  to 
successively  happen  three  times,  the  warning  SEE  SECURITY 
SEE  SECURITY  SEE  SECURITY  would  flash  in  red  letters  on 
the  digital  display  on  the  face  of  either  7. 5  machine. 
Inclusive  with  this  is  an  audible  alarm  that  would  sound  for 
a  pre-programmed  duration.  This  sound  and  L. E. D  warning 
announced  the  occurance  of  a  TYPE  I  ERROR,  as  the  individual 
was  attempting  to  be  RECOGNIZED/VERIFIED. 
3.    Hypothesis  Type  I.  Errors 

Formally,  the  HYPOTHESIS  for  this  Type  I  error 
analysis  is:  the  subject  attempting  entry  IS  located  within 
IBANK  memory.  This  hypothesis  is  true,  but  if  the  hypothesis 
is  true  and  it  is  REJECTED,  an  error  has  been  committed 
known  as  Type  I  error  ( Freund | Williams,  1982,  p. 316).  The 
system  would  NOT  allow  the  individual  to  gain  access,  when 
it  SHOULD  have.  When  a  Type  I  error  did  occur,  a  notation 
was  made  in  the  log  sheet  using  the  symbol  N  for  NO. 

At  each  session,  all  sixteen  subjects  were  required 
to  complete  six  trials.  One  trial  is  defined  as  receiving 
either  a  Y  or  N.  Two  sessions  of  six  trials  would  have  to  be 
finished  before  the  subject  was  considered  done  in  reference 
to  testing  under  a  specific  FACTOR.  It  was  the  system 
operator's  responsibility  to  randomly  assign  cycle  per 
minute  settings  of  either  6.0  cpm  or  3.0  cpm  as  the  subject 
was  being  tested  in  the  motion  simulator.  An  example  to 
provide  clarity  follows. 
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On  day  one,  subject  0037  reports  at  1100am  to  be 
tested  using  the  DAISY  scanner  at  a  roll  of  14  degrees. 
Before  energizing  the  electric  motor,  the  system  operator 
sets  the  handwheel  atop  the  variable  drive  to  correspond  to 
a  cycle  time  of  10  seconds.  Six  trials  are  to  be  taken,  so 
the  first  three  trials  are  noted  with  the  cycles  per 
minute( cpm) at  6. 0( ( 60sec/min) *( lcycle/10  sec)).  The  second 
three  trials  are  taken  with  a  3.0  cpm.  The  system  operator 
was  able  to  vary  CPM  settings  as  the  platform  rotated.  This 
way  the  student  would  not  be  distracted  and  physically 
jolted  by  a  constant  starting  and  stopping  of  the  motor. 

Initially,  many  students  were  inquisitive  concerning 
when  they  should  depress  the  SCAN  button  when  testing  on  the 
transverse  motion  simulator.  Common  sense  would  tell  them  to 
do  this  at  either  a  roll  of  zero  degrees  or  at  the  extreme 
port  or  starboard  angle  of  roll.  It  was  at  these  positions, 
that  upright  attitude  for  the  former  and  relative  motion  for 
the  latter  ,  create  the  most  comfortable  atmosphere.  All 
sixteen  who  participated,  were  instructed  to  depress  the 
SCAN  button  whenever  they  felt  at  ease  in  doing  so,  ensuring 
that  data  would  be  collected  in  a  RANDOM  manner.  From  the 
onset,  there  was  never  a  problem  with  retaining  totally 
random  roll  positions  that  7. 5  scans  were  taken  at.  As  time 
progressed,  their  apprehension  was  alleviated,  because  with 
repetition,  they  saw  how  easy  it  was  to  scan  at  any  angle. 

The  format  of  the  four  log  sheets  maintained  by  the 
system  operator  consisted  of  two  columns  used  to  annotate  a 
Y  or  N  score.  The  left  column  for  data  entries  corresponding 
to  a  shipboard  period  of  roll  of  TEN  seconds  and  the  right  a 
period  of  roll  of  TWENTY  seconds.  The  six  separate  testing 
FACTORS  (DOT,  DAISY,  roll=7,  roll=14,  cycle  time  10  sec, 
cycle  time  20  sec)  made  up  the  log  sheets  and  are  noted  in 
the  following  list. 
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1.  Log  sheet  1:  Using  the  DAISY  ICAM  at  seven  degree  roll 

2.  Log  sheet  2:  Using  the  DAISY  ICAM  at  a  fourteen  degree 
roil 

3.  Log  sheet  3:  Using  the  DOT  ICAM  at  a  seven  degree  roll 

4.  Log  sheet  4:  Using  the  DOT   ICAM  at  a   fourteen  degree 
roll 

As  mentioned  previously,  all  scans  were  taken  in  the 
RECOGNITION  mode,  where  that  scan  would  have  to  be  matched 
against  all  576  bit( 72  byte  templates): 

either  stored  in  the  EEPROM  (electrically  eraseable 
programmable  read  only  memory  chip)  for  twenty  or  less 
enrollees,  or  BUBBLE  MEMORY  with  a  capacity  of  up  to 
twelve   hundred  enrollees.  (Eye-dent,  1985) 

While  the   VERIFICATION  mode  provides  greater   security  than 

the  RECOGNITION  mode  because  both  an  eye  scan  and  a  PIN  must 

be  correctly  accepted  by  the   machine,   it  was  not  included. 

VERIFICATION  requires   personnel  to  MEMORIZE   and  physically 

KEY-IN   their  personal   identification   number(PIN)   to   the 

twelve  digit  keypad   on  the  face  of  7.  5.    This  defeated  the 

purpose  of  investigating  a  system   that  does  not  require  the 

use  of  a  memory  code  or  password.  One  of  the  directions  that 

this  thesis  was   determined  to  take  was   analyzing  this  very 

principle.    ONLY  THROUGH   THE  RECOGNIZE  MODE  COULD   THIS  BE 

ACCOMPLISHED. 


E.   THE  RESULTS 

NOT  RECOGNIZED  percentages  were  computed  by  counting  all 
scans  taken  by  either  the  DOT  or  DAISY  scanner  at  the 
appropriate  angle  of  roll.  This  number  was  then  divided  into 
the  number  of  correlation  scores  that  were  +0. 59  and  lower. 
These  percentages  are  listed  in  Table  1  .  The  newly 
introduced  DOT  7.  5  clearly  shows  in  its  data  that  when  used, 
queue  time  drops   significantly  when  compared  to   the  DAISY. 
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For  example,  at  fourteen  degrees  inclination,  only  13  out  of 
202  DOT  scans( 6. 44%)were  logged  as  NOT  RECOGNIZED  (which 
means  that  scan  was  unacceptable),  while  66  out  of  251 
scans( 26. 29%)  was  the  corresponding  percentage  for  the 
DAISY.  Additionally,  for  BOTH  machines,  as  the  angle  of 
roll  increased,  the  higher  the  ratio  of  NOT  RECOGNIZED  to 
TOTAL  scans  .  This  implies  increased  queue  time,  the  greater 
the  sea  state.  Figure  2. 4  is  a  column  chart,  with  NOT 
RECOGNIZED  percentages  for  the  DAISY  7.5  and  the  DOT  7.5  on 
the  y  axis  versus  angle  of  roll  in  degrees  on  the  x  axis. 

30  t 


No*  Recognized 


Dot  Overall  =  5  3615 
Daisy  Overall  =  24. 1% 


7  14 

Angle  of  Roll  Degrees 

Figure  2. 4  Not  Recognized  Percentages 

AVERAGE  CORRELATION  SCORES  for  RECOGNIZED  PIN1 s  were 
computed  by  summing  correlation  scores( +0. 60  and  higher), 
from  the  appropriate  serial  printer  log  sheet  and  dividing 
by  the  number  of  successful  recognized  scans.  This  for  a 
particular  Eye-Dentify  and  its  requisite  testing  criteria. 
This  data  is  noted  in  Table  2  ^  DOT  7.5  scores  for  seven 
and   fourteen  degrees    of    roll   were   above    the   +0.  90 
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TABLE    1 
NOT  RECOGNIZED  PERCENTAGES 


DAISY  7  DEGREES:  58  NOT  RECOGNIZED  OUT  OF  TOTAL 


OF  251  SCANS     58/251=  .2310  =  23. 


DAISY  14  DEGREES:  66  NOT  RECOGNIZED  OUT  OF 
TOTAL  OF  251  SCANS     66/251=  .2629  =  26.29% 


DOT  7  DEGREES:  9  NOT  RECOGNIZED  OUT  OF  TOTAL 
OF  208  SCANS     9/208=  . 04326  =  4. 326% 


DOT  14  DEGREES:  13  NOT  RECOGNIZED  OUT  OF  TOTAL 
OF  202  SCANS.    13/202=  . 06435  =  6. 435% 


DAISY  OVERALL:  124  NOT  RECOGNIZED  OUT  OF  TOTAL 
OF  502  SCANS    124/502=. 2470  =  24.70% 


DOT  OVERALL:  22  NOT  RECOGNIZED  OUT  OF  TOTAL 
OF  410  SCANS    22/410=. 0536  =  5. 36% 
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plateau,  (+0.912,  +0.906  respectively)  easily  surpassing  the 
maximum  allowable  RECOGNITION  threshold  setting  of  +0.  85. 
The  system  operator  might  want  to  implement  this 
setting( +0. 85 )  for  maximum  security  requirements.  The  DAISY 
7.5  was  in  the  low  "eighties",  (  +0.  823 , +0.  802 )  respectively 
and  would  not  have  met  this  limit.  It  is  noteworthy  to 
realize  that  these  are  only  AVERAGES,  nonetheless  this 
comparison  between  the  two  machines  does  imply  a  definite 
trend  that  they  have  differing  performance  characteristics. 

Both  DOT  and  DAISY  machines  had  AVERAGE  correlation 
scores  for  NOT  RECOGNIZED  scans  in   the  same  range  of  (+0.41 

+0.44).  Figure  2.5  is  a  column  chart  of  average 
CORRELATION  scores  for  the  DAISY  7.5  and  DOT  7.5  on  the  y 
axis  versus  angle  of  roll  in  degrees  on  the  x  axis. 
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Figure  2. 5  Ave  Correlation  Scores 
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TABLE   2 
AVERAGE  CORRELATION  SCORES 


DAISY  7  DEGREES:  AVE  CORRELATION  SCORE  FOR 
RECOGNIZED  WAS  159.21/193=  +.8249 

AVE  CORRELATION  SCORE  FOR  NOT  RECOGNIZED  WAS 
25. 68/58=. 4427 

DAISY  14  DEGREES:  AVE  CORRELATION  SCORE  FOR 
RECOGNIZED  WAS  148.37/185=  +.8020 

AVE  CORRELATION  SCORE  FOR  NOT  RECOGNIZED  WAS 
29. 51/66=. 4471 

DOT  7  DEGREES:  AVE  CORRELATION  SCORE  FOR 
RECOGNIZED  WAS  181.51/199=  +.91211 

AVE  CORRELATION  SCORE  FOR  NOT  RECOGNIZED  WAS 
3. 73/9  =. 4144 

DOT  14  DEGREES:  AVE  CORRELATION  SCORE  FOR 
RECOGNIZED  WAS  171.37/189=  +.90671 

AVE  CORRELATION  SCORE  FOR  NOT  RECOGNIZED  WAS 
5. 75/13=. 4423 

AVE  CORRELATION  SCORE  FOR  7  DEGREES  WAS 
340. 72/392=  +0. 8692 

AVE  CORRELATION  SCORE  FOR  14  DEGREES  WAS 
319. 74/374=  +0. 8549 

AVE  CORRELATION  SCORE  FOR  CPM  OF  3.0=  +0.8508 
AVE  CORRELATION  SCORE  FOR  CPM  OF  6.  0=  +0. 8377 
DAISY  OVERALL  AVE  CORR.  SCORE  307. 58/378=  +0. 8137 
DOT  OVERALL    AVE  CORR.  SCORE  352.88/388=  +0.9095 
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As  stated  earlier,  a  trial  was  complete  when  either  a 
Y(yes)  for  a  RECOGNIZED  eye  scan  was  logged  or  a  N(no)  which 
represented  a  TYPE  I  error( three  successive  NOT  RECOGNIZED 
eye  scans)  was  noted.  A  binomial  distribution  was  expected 
concerning  the  data  dealing  with  these  trials,  where  the 
number  of  trials  was  fixed,  the  probability  of  a  success  was 
the  same  for  each  trial,  and  that  the  trials  were  all 
independent  ( Freund | Williams,  1982).  The  trial  results 
collected  on  each  subject  were  logged  in  groupings  of  six, 
and  each  had  a  particular  cycle  per  minute  speed  setting, 
angle  of  roll  and  7.  5  machine  associated  with  it.  Data 
points  could  then  be  found  by  solving  for  the  ratio  of 
Y(yes)  trials  in  the  numerator  divided  by  6  total  trials  in 
that  grouping.  Three  proportions  were  noted.  They  were 
(6/6)=  1.00,  (5/6)=  0.833  and  (4/6)=  0.666.  There  were  a 
total  of  128=( 768  trials/6)  separate  data  points.  The 
mathematical  transformation  formula  y=  2arcsine( sqrt( x) )  was 
used  to  stabilize  the  variance  in  the  data  (Winer,  1971).  To 
utilize  this  equation,  the  values  0. 666,  0.  833  and  1.  00  had 
to  be  converted  to  radians.  These  radian  values  were 
3.1416(pi),  2.3006  and  1.9106  respectively,  and  were  entered 
as  (x)  in  the  transformation  formula.  A  level  of 
significance  of  0. 05  was  selected  when  using  F  tables. 

A  four  way  analysis  of  variance( AOV)  done  by  a  computer 
AOV  'package'  was  implemented  on  the  data.  The  results  are 
listed  in  Table  3  . 

The  analysis  showed  that  the  effect  of  both  A( angle  of 
roll)  (F=  5.7870,  DF=  1,15)  and  Su  x  Sp  x  A  ( F=  2.8070,  DF= 
15,15)  were  the  most  significant  relationships  measured. 
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TABLE  3 
ANALYSIS  OF  VARIANCE/EYE -DENT I FY  7.5  RECOGNITION  RATE 


SOURCE 


DF 


SS      MS=       F=        F  ratio 

SS/DF   SS/MS | err   from  tables 


Su( Subjects) 

15 

Sp( Speed )cpm 

1 

A( Angle) 

1 

M( Machine) 

1 

Su  x  Sp 

15 

Su  x  A 

15 

Su  x  M 

15 

Sp  x  A 

1 

Sp  x  M 

1 

A  x  M 

1 

Su  x  Sp  x  A  15 

Su  x  Sp  x  M  15 

Sp  x  A  x  M  1 

Su  x  A  x  M  15 


1. 1877   0. 0792 


0. 0012   0. 0012 


0.2309   0.2309 


0. 1101   0. 1101 


1.3376   0.0892 


0. 7543   0. 0503 


0. 8750   0. 0583 


0. 0130   0. 0130 


0.0012   0.0012 


0.0335   0.0335 


1. 6793   0. 1120 


0. 9839   0. 0656 


0.0336   0.0336 


0. 5979   0. 0399 


1. 9850 

2.  40 

0. 0301 

4.  54 

5. 7870 

4.  54 

*sig* 

2. 7594 

4.  54 

2. 2356 

2.  40 

1.  2607 

2.  40 

1. 4612 

2.  40 

0. 3258 

4.  54 

0. 0301 

4.  54 

• 

0. 8396 

4.  54 

2. 8070 

2.  40 

*sig* 

1. 6441 

2.  40 

0.  8421 

4.  54 

1.  0000 

2.  40 

ERROR 


TOTAL 


15    0. 5979   0. 0399 


127    8.4371 


Level  of  significance  =  0.  05 
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III.   DISCUSSIONS 

A.   ERRORS 

1.    Type  I.  Errors 

The  listing  shown  in  Table  4  and  Table  5  gives  the 
breakdown  of  Type  I  errors  that  occured,  given  a  particular 
Eye-Dentify  machine,  cycle  per  minute  rate( represented  by 
ZERO-MAX  settings  of  either  1.  0  or  1.5)  and  angle  of  roll. 
The  numerator  of  the  fraction,  contains  the  number  of  false 
rejections( three  NOT  RECOGNIZED  scans  sequentially  by  the 
same  person)  and  the  denominator,  the  total  scans  attempted 
by  the  individual  under  these  criteria. 

The  four  column  charts  that  follow  Table  4  and  Table 
5,  display  Type  I  error  results.  Figure  3.  1  charts  the 
NUMBER  of  Type  I  errors  on  the  y  axis  versus  DOT  and  DAISY 
scanners  on  the  x  axis.  Figure  3.2  charts  the  NUMBER  of  Type 
I  errors  on  the  y  axis  versus  the  period  of  roll  in  cycles 
per  minute  on  the  x  axis.  Figure  3. 3  charts  the  NUMBER  of 
Type  I  errors  on  the  y  axis  versus  the  angle  of  roll  in 
degrees  on  the  x  axis.  Figure  3.4  charts  the  Type  I  error 
PERCENTAGE  for  this  experiment  only,  on  the  y  axis  versus 
the  corresponding  DOT  and  DAISY  scanner  on  the  x  axis. 

The  overall  Type  I  error  rate  was  thirteen  errors 
out  of  a  total  of  768  trials  or  1. 69%.  Brochures  from  the 
Eye-Dentify  company( 1985 )  state  that,  "the  chance  of  a  false 
rejection(  Type  I  error)  is  AS  LOW  AS  0.1%  dependent  on  the 
system  threshold  setting  and  proper  use."  (Eye-Dentify 
Inc.  ,  1985)  No  formal  experiment  was  published  which 
indicates  that  this  probability  was  tested  (Helle,  1985).  A 
company  spokesman  did  elaborate  though,  that  this  value 
could  be  achieved  under  ideal  conditions  ,    consisting   of 


32 


TABLE  4 
TYPE  I   ERROR  RATES 


14  DEGREE  ROLL 
DOT  SCANNER 

Cycle/Min  rate  --3. 0  6.0 

TY. I  ERROR/TRIALS 

2/96=  2.08%      1/96=  1.04% 

14  DEGREE  ROLL 
DAISY  SCANNER 

3.0  6.0 

3/96=  3. 13%      4/96=  4. 17% 

7  DEGREE  ROLL 
DOT  SCANNER 

3.0  6.0 

0/96=  0.00%      1/96=  1.04% 

7  DEGREE  ROLL 
DAISY  SCANNER 

3.0  6.0 

1/96=  1. 04%      1/96=  1.  04% 
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TABLE  5 
BREAKDOWN  OF  TYPE  I  ERRORS 


**TOTAL  NUMBER  OF  TYPE  I  ERRORS  (N)=  13** 
DAISY  TYPE  I  error  =   9  out  of  13 
DOT   TYPE   I  error  =   4  out  of  13 
14  DEG  ROLL  TYPE  I  =  10  out  of  13 
7  DEG  ROLL   TYPE  1=3  out  of  13 
CYCLE  TIME  10  sec   =   7  out  of  13 
CYCLE  TIME  20  sec   =   6  out  of  13 
768(96*8)  TRIALS  LOGGED  DURING  TESTING 
OVERALL  TYPE  I  FAILURE  =  13/768=.  0169=1.  69J 
OVERALL  SUCCESS  =1-. 0169=. 9830=  98.30% 
DAISY  TYPE  I  ERR%   =  9/(768/2)=  2.34% 
DOT  TYPE  I  ERROR  %  =  4/(768/2)=  1.04% 
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excellent  enrollments  and  proper  scanning  procedures.  Since 
this  test  measured  the  accuracy  of  both  DAISY  and  DOT 
machines  at  the  lowest  possible  RECOGNITION  threshold 
setting  of  +0. 60,  increasing  the  setting  would  increase  the 
Type  I  error  rate.  Proper  use  of  the  machines  and  the  strict 
following  of  user  instructions  is  an  extremly  important 
aspect  to  consider  when  discussing/dissecting  these  results. 
The  enrollment  procedure  and  concentration  by  the  subject 
being  scanned,  are  just  a  few  variables  that  can  effect  the 
outcome. 

The  most  substantial  relationship  discovered  in  the 
transformation  variance  computations  was  that  of  increasing 
the  angle  of  roll  on  the  transverse  motion  simulator.  The 
computed  F  ( SS/MS  error)  was  5.7870.  The  value  from  the  F 
tables( level  of  significance  =  0.05)  was  4.54.  Ten  of 
thirteen(  10/13 )  Type  I  errors  occured  when  roll  was 
increased  from  seven  to  fourteen  degrees.  While  other 
relationships  were  not  as  significant  as  this,  (i.e.,  no 
significance  surfaced  when  examining  the  variance  analysis), 
certain  outcomes  should  be  noted.  Fifty  percent  (8/16)  of 
the  subjects  tested  did  not  have  any  occurance  of  Type  I 
errors.  Of  the  remaining  eight  subjects  that  had  Type  I 
errors,  4  of  the  8  had  69.2%  of  the  errors. 

The  newer  version  machine(DOT)  had  fewer  Type  I 
errors  (4/13)  than  the  DAISY,  which  might  be  attributed  to 
the  fact  that  fifteen  out  of  sixteen  subjects  preferred 
using  the  DOT  7.5,  feeling  more  confident  when  using  it.  One 
felt  that  with  his  poor  eyesight,  "it  was  difficult  to 
distinguish  the  daisy  pattern,  yet  could  line  up  quite 
easily  the  blurry  cone  with  the  three  green  dots. "  Those 
that  are  color  blind  to  greens  and  reds  will  have  problems 
with  the  DAISY  7.5,  but  they  will  function  with  the  DOT 
where  depth  perception  and  not  color  is  important.  The  one 
subject,   PIN(0038)   that  preferred  the  DAISY,   had  three  of 
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the  total  thirteen  Type  I  errors(23%).  Two  of  those  three 
occured  on  the  DOT.  The  remaining  fifteen  subjects  liked  the 
three  dimensional  cone/dot  depth  alignment  system  on  the  DOT 
over  the  two  dimensional  plane  view  of  the  greenish-white 
daisy  wheel  provided  on  the  DAISY. 

For  health  reasons,  it  would  seem  wise  to  utilize 
the  recessed  eye  port  construction  of  the  DOT  because  the 
eye  does  not  come  in  contact  with  anything.  The  forehead  is 
placed  on  the  headrest.  With  the  DAISY,  the  eyeball  and 
possible  tears  have  a  greater  chance  of  coming  in  contact 
with  the  rubber  protection  guards,  promoting  the  possible 
spread  of  a  virus  or  germs  to  others.  Overall  Non- 
Recognition  percentages  for  DOT  were  (5.36%)  and  (24.70%) 
for  DAISY.  This  implies,  a  person  using  the  DAISY  7. 5  is 
inevitably  going  to  have  to  scan  many  more  times  to  gain  the 
same  amount  of  acceptances  allowed  through  the  use  of  a  DOT 
7.  5. 

Slightly  more  Type  I  errors  occured  (7  out  of  13), 
when  the  'period  of  roll1  was  increased  implying  that  in 
heavy  seas,  the  machine's  performance  could  be  downgraded 
because  of  problems  with  keeping  the  head  still.  A  solution 
to  this  might  be  to  shape  a  curved  recess  into  the  forehead 
rest  of  the  DOT  7.5,  to  allow  one's  forehead  to  fit  within 
it  for  greater  stability  in  rough  seas.  The  DAISY  does  not 
allow  this  option,  due  to  its  outwardly  radiated  eyeport 
construction.  One  student  stated  however,  that  resting  the 
sockets  of  the  eye  on  the  rubber  guards  atop  these  eyeports 
does  help  keep  the  head  still.  Installing  handles  close  to 
both  machines  would  aid  in  stabilizing  oneself  in  a 
shipboard  environment. 

In  every  instance  but  one  a  logical  outcome  appeared 
as  the  factors  were  adjusted  when  testing  the  machines 
aboard  the   transverse  motion   simulator.   All   results  were 
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poorer  as  angle  of  roll  was  increased,  period  of  roll(sec) 
was  increased  and  when  the  older  DAISY  7. 5  was  used.  An 
example  of  this,  noted  earlier( Table  2),  would  be  the  large 
difference  between  the  machines  when  comparing  OVERALL 
average  RECOGNIZED  correlation  scores.  DOT  =  +0.9095,  DAISY 
=  +0.8137,  the  difference  being  +0.0958.  The  one  exception 
to  this  logic  was  the  occurance  of  five  (Type  II) 
RECOGNITION  false  acceptances  ONLY  on  the  DOT  7.5.  This 
exception  is  discussed  in  the  following  text. 
2.    Tvoe  II  Errors 

Type  II  errors  did  occur  in  both  the  RECOGNIZE  and 
VERIFY  modes.  Formally,  the  HYPOTHESIS  for  this  Type  II 
analysis  can  be  stated  :  the  subject  attempting  entry  IS 
located  in  Ibank  memory  and  wants  to  be  identified  by 
matching  his/her  own  personal  identification  number  (PIN)  OR 
BY  MATCHING  ANY  OTHER  AVAILABLE  PIN  in  Ibank  memory  to  gain 
access.  This  hypothesis  is  of  course  FALSE  because  the 
machine  is  designed  to  accept  subjects  only  against  their 
own  PIN.  If  this  FALSE  hypothesis  is  ACCEPTED  by  the 
machine  as  TRUE,  an  error  has  occured.  This  is  known  as  a 
TYPE  II  error  ( Freund| Williams,  1982,  p. 316).  In  'laymens' 
terms,  someone  is  allowed  access  (false  identification  and 
acceptance)  by  the  7.5.  Although  the  subject  was  located  in 
Ibank  memory,  he  SHOULD  NOT  have  been  recognized/verified 
under  ANOTHER  subject's  PIN. 

In  strict  probabilistic  terms,  Type  II  errors  can 
mathematically  happen,  but  are  not  expected  to  occur, 
because 

every  person,  even  an  identical  twin  ,  has  a  widely 
divergent  ,  unalterable  retinal  eye  pattern.  The 
chance  of  false  acceptance  in  the  VERIFICATION  mode  is 
0. 0001%( one  in  a  million),  with  the  phase  correction  on 
(normal  operation).  The  correlation  coefficient  being 
+0. 70.  The  purpose  of  the  software  implemented  phase 
corrector  is  to  compensate  for  eye  rotation  about  the 
visual  axis.  This  eye  rotation  is  the  result  of  tilting 
the  subject  s   head  with   relation  to  his/her  orientation 
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during  the  enrollment  process.  (Oregon 
and  Industry,  'White  Paper' ,  1984) 


Museum   of   Science 


The  corresponding  odds  of  a  false  acceptance( Verification 
mode)  with  the  correlation  coefficient  set  at  the  minimum 
+  0.  60,  is  approximately  one  in  sixteen- thousand  five  hundred 
and  two( 1/16,502)  or  +0.00606%.  This  minimum  setting( +0. 60) 
was  used  throughout  the  experiment.  The  odds  were  derived 
from  studies  at  the  OREGON  MUSEUM  OF  SCIENCE  AND  INDUSTRY  in 
Portland,  Oregon  10  October  1984.  The  odds  represented  here 
is  the  result  of  a  revision  to  their  findings  by  the  Eye 
Dentify  company.  Originally  their  report  had  stated  these 
odds  were  one  in  forty  five  thousand( 1/45, 000)  or  0.00222%. 

The  probability  of  a  Type  II  error  is  hard  to  fixate 
in  the  RECOGNITION  mode  because  it  depends  on  the  population 
size  in  bubble  memory  and  the  correlation  threshold  setting 
that  is  assigned  by  the  system  manager.  For  example,  the 
LOWEST  security  provided  would  occur  with  the  correlation 
threshold  set  at  +0.60  in  the  RECOGNIZE  mode  and  1200(  the 
maximum)  individuals  stored  in  bubble  memory.  As  memory 
population  increases  from  0000  to 
1200( 0000,0001,0002, ...  1200) ,  the  greater  the  odds  that  a 
Type  II  error  may  occur  because  more  eye  patterns  are 
available  to  be  compared/matched  against.  This  dilemma  does 
not  lend  itself  to  VERIFICATION  mode,  because  this  method 
requires  the  entering  of  the  personal  identification  number. 
A  one  to  one  eye  template  match  is  then  attempted. 
Therefore,  an  INDIRECT  relationship  between  this  coefficient 
and  the  occurance  of  Type  II  error  is  documented.  The 
smaller  the  identification  threshold  coefficient,  the 
greater  the  probability  of  a  false  acceptance.  With  Type  I 
errors,  the  reverse  is  true; ( DIRECT  relationship).  The 
larger  the  threshold  coefficient,   the  greater  the  odds  that 
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false   rejections  will   occur  because   the  administrator   is 
'tightening'  security. 

In  the  initial  motion  experiment,  utilizing  the 
sixteen  students,  one  male  (personal  identification  number 
0060)  was  falsely  recognized  under  another  male's  code; (PIN 
0025).  The  DOT  7.5  was  used  in  this  instance.  NO  false 
RECOGNITIONS  were  EVER  noted  during  the  motion  experiment 
using  the  DAISY  7. 5.  Neither  male  had  difficulties  during 
the  enrollment  process,  with  the  exception  of  a  machine 
"lock-up"  that  required  the  system  operator  to  re-start  the 
enrollment  process  with  PIN  0060.  A  "lock-up"  connotes  that 
keyboard  commands  and  'carriage  returns'  are  not  accepted  by 
the  Eye-Dentify  software.  To  alleviate  the  situation,  power 
was  secured  and  re-energized,  and  the  entire  process 
reinitiated.  To  insure  that  possible  bad  templates  were  not 
located  in  IBANK  memory  under  PIN  0060,  all  IBANK  records 
were  listed  and  checked.  None  were  found  in  memory  for  this 
particular  male.  No  difficulties  were  encountered  during  the 
second  enrollment  of  PIN  0060.  It  is  extremly  important  to 
grasp  that  the  ONE  false  RECOGNITION  occuring  on  8  November 
1985,  was  related  to  PIN  0060' s  SECOND  ENROLLMENT  AND  NOT 
HIS  DELETED  FIRST. 

The  correlation  score  associated  with  this  specific 
Type  II  error  was  +0.67.  He  was  being  tested  with  the  angle 
of  roll  set  at  a  maximum  of  fourteen  degrees,  and  cycle  per 
minute  values  of  3.  0  and  6.  0.  At  all  sessions,  as  noted 
earlier,  six  trials  were  taken.  He  was  successfully 
recognized  the  first  three  scans,  FALSELY  on  the 
fourth( cpm=3. 0)  and  successfully  on  the  latter  two.  The 
72-byte  'recognize'  signature  templates  of  the  matched 
males,  were  separated  by  a  margin  of  (0060-0025  =  35)  PIN 
positions  in  bubble  memory. 
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On  the  same  day,  a  female( 0067 )  was  falsely 
RECOGNIZED,  three  successive  times  with  scores  of  +0.61, 
+  0.60,  +0.63  under  the  PIN  of  another  f emale( 0063 ) .  These 
were  initially  considered  questionable  because  0067  had  some 
difficulties  enrolling.  She  DID  meet  the  requirements  of  the 
enrollment  process  stated  in  the  user's  manual.  Many 
enrollment  scans  had  to  be  rejected  via  a  N0(N)  response  to 
the  question  OK  TO  AVERAGE?  shown  on  the  cathode  ray 
terminal,  because  they  were  not  at  least  +0.90.  The  system 
operator  was  eventually  able  to  acquire  five  scans  above 
+0. 90  in  reasonable  time.  A  decision  to  re-enroll  was  made 
however,  to  try  to  attain  better  eye  templates.  The  former 
scans  were  ignored  and  deleted  from  the  system  operator's 
log  and  IBANK  memory  respectively  when  she  enrolled  a  second 
time  very  easily.  The  log  was  later  recalled  as  a  record 
that  the  three  scores  were  legitimate  Type  II  errors.  This 
due  to  additional  'VERIFICATION'  false  acceptances  between 
PIN  0067  and  0063  in  later  trials,  that  implied  a  probable 
similarity  between  the  eye  patterns  of  these  two  female 
subjects.  No  additional  false  recognitions  were  logged  with 
this  particular  female  or  any  other  person  related  to  the 
transverse  motion  simulator  test  up  to  this  point. 

A  decision  was  made  to  change  over  to  VERIFICATION 
mode  on  25  NOV  1985  and  test  ONLY  four  specific  individuals. 
Those  two  subjects  ( 0060, 0067 ) that  had  Type  II  recognition 
errors  occur  in  the  motion  test,  along  with  the  two  other 
subjects( 0025, 0063 )  that  they  had  been  matched  up  against  by 
the  DOT  7. 5.  This  strategy  included  a  second  enrollment  of 
all  four  individuals.  This  time  existing  templates  would  NOT 
be  erased.  Now  all  four  would  have  two  separate  templates 
in  bubble  memory.  Of  these  four,  only  one  (0060)  had  both  a 
Type  I  error  and  a  false  RECOGNITION  Type  II)  occur  during 
testing. 
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The  system  operator  programmed  the  DOT  7. 5  for 
verification  parameters  and  then  tested  whether  a  false 
match  might  be  achieved  by  scanning  the  eyes  of  one  person 
against  the  two  eye  patterns  of  their  match  stored  in  IBANK 
memory.  To  do  this,  the  four  digit  PIN  of  the  person  trying 
to  be  matched  was  entered  in  the  numeric  keypad  of  the  Eye- 
dentify  machine.  The  purpose  of  re-enrolling,  was  to  double 
the  chances  of  noting  false  verifications  and  to 
ELIMINATE/REDUCE  the  probability  that  system  operator  error 
was  responsible  for  the  THREE  false  RECOGNITIONS  between 
PIN(0067)  and  PIN(0063)  and  the  ONE  false  RECOGNITION 
between  PIN  0060  and  PIN  0025  reported  earlier.  This,  in 
addition  to  the  coincidence  that  the  only  occuring 
software/hardware  "keyboard  lock-up"  on  8  November  1985 
happened  to  that  same  individual,  namely  0060.  Males  only 
tested  against  males,  females  only  tested  against  females. 
Testing  under  these  circumstances,  provided  the  results 
noted  in  Table  6  . 

For  Table   6,    MALE   1(0060)  is   represented  by 

PIN' s( 0060,0069).     MALE    2(0025)  is    represented   by 

PIN' s( 0025,0071).     FEMALE   1(0063)  is   represented    by 

PIN" s( 0063,0070).   FEMALE   2(0067)   is  represented  by  PIN's 

(0067,0072).   The  first  PIN  (O,   )   is  the  older  enrollment, 
and  the  second  PIN  (  ,N)the  newer. 

On  25  NOV  1985,  a  false  VERIFICATION  was  recorded 
with  a  correlation  score  of  +0. 64.  The  significance  of  this 
particular  scan,  was  that  it  was  the  first  time  one  had 
occured  against  a  NEWLY  enrolled  PIN.  Many  more  were  to 
follow; (See  Table  6).  These  new  PINs,  with  their 
corresponding  40  byte  'verification'  templates  in  IBANK 
memory,  were  created  under  the  most  carefully  scrutinized 
enrollment  procedures.  The  thesis  advisor  witnessed  the 
routine   followed.  The   occurance  of  this  particular  Type  II 
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DOT  TABLE  (6)  TYPE  II  ERRORS-  VERIFICATION  ONLY 

0060-  MALE  1,  trying  to  match  MALE  2,  (old  PIN  0025,  new 
PIN  0071) 

false  verification  scores:  .  60  .65  .61  .63  .64  .64-(0025) 

.67  .60  .64  .65  .64  .65 

.63  .64  .67 (0071) 

15/58  =  25. 86%  15  scans  out  of  58  were  false 
verifications. 

0025-  MALE  2,  trying  to  match  MALE  1,  (old  PIN  0060,  new 
PIN  0069)  .62 (0060) 

false  verification  scores  of : . 64  .60  .62  .63  .65  -(0069) 

.  62 
7/44=  15.  91%  7  scans  out  of  44  were  false  verifications. 

0063-  FEMALE  1,  trying  to  match  FEMALE  2,  (old  PIN  0067, 

new  PIN  0072) 

false  verification  scores  of:  1(  .  60)  4(.61)  5(.62)  2(.63) 

4(.64)  1(.65) ..--(0067) 

5(.60)  3(.61)  2(.62)  6(  .  63  )  2(  .  64)  3(.65)  1(  .  66)  --(  0072  ) 

39/59  =  66. 10%  39  scans  out  of  59  were  false 
verifications. 

0067-FEMALE  2,  trying  to  match  FEMALE  1,  (old  PIN  0063, 
new  PIN  0070) 

NONE (0063) 

false  verification  scores  of:  .61  .63  .61  (0070) 

3/11=  27.  28%  3  scans  out  of  11  were  false  verifications. 
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VERIFICATION  error  seemed  to  eliminate  improper  enrollment 
procedures  as  a  cause  for  all  the  false  acceptances.  Also 
on  that  same  date,  a  FIFTH  Type  II  error  under  the  RECOGNIZE 
mode  happened  when  on  the  fifth  of  six  trials,  PIN  0060  was 
again  incorrectly  recognized  as  PIN  0025,  with  a  correlation 
score  of  +0. 63.  ALL  FIVE  TYPE  II  RECOGNITION  ERRORS  OCCURED 
ON  THE  DOT  2-5  ,  with  the  motion  simulator  activated. 

Initially,  these  tests  had  not  been  performed  on  the 
DAISY  7. 5  because  NO  false  recognitions  occured  during 
normally  scheduled  simulator  motion  testing.  Upon  request 
from  the  Eye-Dentify  company  of  Beaverton  Oregon,  identical 
experimentation  was  completed  on  the  DAISY  scanner.  The 
reason  they  were  requesting  this  continuation  of  testing, 
was  to  determine  if  the  numerous  Type  II  verification  errors 
that  were  consistently  occuring  to  these  four  subjects,  only 
on  the  DOT  7.  5  along  with  five  false  recognitions,  were 
caused  by  a  defective  camera.  Internal  feedback  from  the 
DOT's  hardware  or  software  was  also  considered.  This  might 
have  created  poor  enrollment  templates. 

If  identical  FALSE  recognitions/  verifications  on 
the  DAISY  scanner  were  to  prevail,  this  might  disprove  their 
theory,  or  at  least  make  them  test  much  more  extensively. 
CROSS  TALK,  a  coding  system  used  by  the  company  on  all  their 
machines  was  found  to  be  correct  in  the  DOT  machine.  The 
value  was  +0.044,  which  was  stenciled  in  its  internal 
cabinet.  This  number  matched  the  value  displayed  on  the 
terminal  monitor  when  the  command  (Control-K)  was  input 
along  with  a  password  when  at  the  main  menu  listing  on  the 
monitor.  The  cross  talk  value  for  the  DAISY  was  +0.060,  but 
no  value  was  found  stenciled  inside  the  cabinet  to  compare 
with. 

All  four  subjects  were  enrolled   a  second  time  on  27 
NOV  1985  into  DAISY  7. 5  bubble  memory.   The  same  requirement 
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of  keeping  the  older  templates  in  memory  in  addition  to 
these  newly  created  ones  was  followed.  The  VERIFY  threshold 
was  at  +0. 60,  a  constant  that  did  not  change  throughout  all 
testing.  Cross  checking  of  the  two  males  and  two  females  was 
completed  in  the  same  manner  that  prevailed  with  the  DOT 
7.  5.  There  was  no  reason  to  cross  check  male  to  female, 
because  no  connection  was  evident.  Out  of  curiosity,  a  few 
female  to  male  cross  checks  were  attempted.  Resultant 
correlation  scores  were  well  below  +0. 45( +0. 00  -  +0.45). 
Testing  under  male/male,  female/female  conditions,  provided 
the  results  listed  in  Table  7. 

For  Table  7,  MALE  1(0060)  is  represented  by 
PIN' s(  0060,0028).  MALE  2(0025)  is  represented  by 
PIN1 s(  0025,0072).  FEMALE  1(0063)  is  represented  byPIN's 
(0063,0071).  FEMALE  2(0056)  is  represented  by  PIN's 
(0056,0070).  The  first  PIN  (O,  )  is  the  older  enrollment, 
the  second  PIN  (  ,N)  the  newer. 

Male  subject  0060  was  scanned  more  than  any 
other, three  hundred  and  thirty  eight(338)  instances,  because 
of  consistent  scores  in  the  "fifties"  (+0.50  -  +0.59).  At 
one  point,  the  system  operator  turned  off  all  the  lights  in 
the  laboratory  to  see  if  that  would  assist  0060  in  getting  a 
false  verification  by  matching  0025.  Although  it  did  seem  to 
help  when  focusing  in  on  the  daisy  wheel  pattern,  there  were 
no  pronounced  changes  in  correlation  scores.  Additionally, 
the  day  before  0060  had  'enrolled'  his  second  time,  the  PIN 
being  0072.  He  was  able  to  correctly  identify  against  this 
NEW  PIN  of  his  quite  easily,  but  was  unable  to  match  when 
verifying  against  his  own  OLD  PIN  0060  created  two  weeks 
earlier.  The  attempts  were  made  over  a  two  hour  time 
duration.  Apparently  the  night  before  0060  received  only  5.  5 
hours  of  sleep  and  stated  he  had  been  tired  all  day.  The 
following  morning,  0060  repeated  the  same  procedure  after  a 
normal   nights   sleep  and  was  identified  against  his  OLD  PIN 
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DAISY  TABLE(7)  TYPE  II  ERRORS-  VERIFICATION  ONLY 

0060-  MALE  1  trying  to  match  MALE  2,  (old  PIN  0025, 

new  PIN  0072) 

false  verification  scores:  .60  — (0025)   NONE  (0072) 

1/338=  0.29%  1  scan  out  of  338  was  a  false  verification. 
128  out  of  the  338  (37.87%)  scans  cross  referencing 
PIN  0060  against  PIN  0025  had  scores  in  the  range  of 
(.50  -.59).  The  ave.  was  +0.534.  There  were  0  in  this 
range  for  the  eleven  scans  cross  referenced  against  new 
PIN  0072.  The  average  correlation  score  for  the  new  PIN 
was  +0.32,  with  two  highs  of  +0.49. 

0025-  MALE  2  trying  to  match  MALE  1,  (old  PIN  0060, 
new  PIN  0028) 

false  verification  scores:     NONE (0060)(0028) 

0/28  =  0. 00%  0  scans  out  of  28  were  false  verification 
The  highest  correlation  score  was  +0. 53  occuring  once. 

0063-FEMALE  1  trying  to  match  FEMALE  2,  (old  PIN  0056, 

new  PIN  0070) 

false  verification  scores:  .61 (0056) 

.60 (0070) 

2/25  =8%   2  scans  out  of  25  were  false  verifications. 
There  was  a  gap  of  four  NOT  VERIFIED  scans, 
before  the  second  Type  II  error  was  recorded. 
She  also  had  3  scans  in  the  "fifties". 

0056-  FEMALE  2  trying  to  match  FEMALE  1,  (old  PIN  0063, 
new  PIN  0071) 

false  verification  scores:    NONE (0063)(0071) 

0/31=0%  Zero  scans  out  of  31  were  false  verifications. 
Her  highest  correlation  score  was  +0. 31. 
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with  consistent  scores  in  the  nineties( +0. 90  -  +0.99).  This 
implies  a  possible  connection  between  FATIGUE  and  being 
acknowledged  by  the  Eye-dentify  7.  5. 

There  were  FIVE  misRECOGNITIONS  (Type  II)  out  of 
934(0.535%)  recognition  scans  for  this 
experiment!  •  67,  .  63 ,  .  63 ,  .  61, . 60 )  on  the  DOT  7.5.  There  were 
SIXTY- FOUR  misVERIFICATIONS  (Type  II)  out  of  a  total  of  172 
verification  attempts  utilizing  the  DOT  7. 5  which  computes 
to  37.21%.  There  were  THREE  misVERIFICATIONS  (Type  II)  out 
of  a  total  of  422  verification  attempts  utilizing  the  DAISY 
7. 5  which  computes  to  0. 71%.  There  were  NO  misRECOGNITIONS 
on  the  DAISY.  One  can  see  that  there  was  a  great  disparity 
in  the  number  of  false  VERIFICATIONS( Type  II)  on  the  DAISY 
7.5  (3.)  versus  the  DOT  7.5  (64)  ,  when  cross  checking 
between  the  four  subjects.  Those  three  (3  out  of  422)  imply 
quite  a  lot  though.  If  none  had  occured,  then  one  might  have 
surmised  that  the  reason  for  so  many  false  verifications  on 
the  DOT  7.5  was  defective  hardware/software  (and/or)  that 
the  particular  machine  was  possibly  a  'lemon'. 

Another  reason  might  be  that  the  DOT  may  create  more 
accurate/defined  signature  templates,  because  the  three 
dimensional  dot/cone  alignment  method  seems  to  have  proven 
its  superiority  over  the  two  dimensional  daisy  pattern.  The 
proof  being  earlier  listed  results.  This  allows  subjects  to 
enroll  under  better  conditions.  When  cross  checking  is  done 
in  VERIFICATION  mode,  one  on  one,  the  different  templates 
relating  to  the  paired  individuals  have  a  greater  likelihood 
of  matching  up.  Although  few  in  number,  the  occurance  of 
those  THREE  false  VERIFICATIONS  on  the  DAISY  implied  that 
there  WERE  eye  pattern  similarities  between  these  four 
specific  individuals.  Two  of  the  three  matches  occured  in 
the  female/female  link.  One  on  the  old  PIN  0056,  one  on  the 
new  PIN  0070.  The  remaining  misverif ication  obviously 
related  to  the  male/male  matching,   and  was  tied  to  the  old 
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PIN  0025.  Future  research  could  investigate  whether 
subjects  of  the  same  sex  have  a  greater  chance  of  matching 
up  against  one  another. 

It  must  be  noted  that  no  other  Type  II 
RECOGNITION/VERIFICATION  errors  have  occured  on  these 
particular  machines  from  APR  1985  to  the  present.  The 
machines  have  been  in  the  Man-Machine  Laboratory( Root  Hall 
107)  Naval  Postgraduate  School,  Monterey,  California, 
undergoing  testing  on  a  continuing  basis.  If  the  number(5) 
of  Type  II  RECOGNITION  errors  were  evaluated  over  the  entire 
timeframe  that  the  DOT  7.5  has  been  tested  at  the  USNPGS, 
the  Type  II  false  recognition  rate  would  be  significantly 
lower.  All  rates  presented  in  this  work  are  a  result  of  this 
specific  thesis  experiment  only. 

B.   OTHER  OCCURANCES/FORMULATIONS 

The  highest  correlation  score  relating  to  the  verify  and 
rdcognize  Type  II  errors  of  this  experiment  was  +0.67. 
Raising  the  lower  identification  threshold  limit  that  the 
CRT  lock  manager  sets,  from  the  present  +0. 60,  to  possibly 
+0. 70  WOULD  INSURE  THAT  THESE  FALSE  ACCEPTANCES  WOULD  HAVE 
NEVER  HAPPENED  (±0.20  >  ±0.62).  A  spokesman  from  Eye- 
dentify  Inc.  stated  that  they  were  in  the  process  of 
revising  their  policy  of  not  allowing  the  correlation 
threshold  to  ever  be  set  below  +0. 71  for  this  reason.  A 
negative  aspect  of  this  policy  would  be  increased  queue  time 
because  correctly  RECOGNIZED/VERIFIED  scores  in  the  +0. 60- 
+0. 70  range  would  now  be  treated  as  unacceptable( NOT 
RECOGNIZED)  by  the  7.5,  requiring  additional  eye  scans  that 
take  more  time. 

A  theory  was  formulated  after  consultation  with  Eye- 
dentify  Inc.  that  dealt  with  enrollment  procedures.  It  was 
thought  that  accepting  only  very  high  enrollment  correlation 
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scores( +0. 90  -  +0.99)  might  have  a  negative  effect  on  the 
digitized  waveform  that  is  processed  and  stored  as  the 
signature  template.  This  waveform  is  created  from  reflected 
light  generated  from  the  beam  of  the  ultra-low  infrared 
light  during  the  scanning  process.  This  theorized  negative 
effect  was  mentioned  as  a  possible  cause  of  recurring  Type 
II  errors.  In  response,  all  sixty  original  enrollees  were 
entered  into  the  system  under  the  same  stringent  conditions 
of  accepting  only  enrollment  scans  in  the  'nineties'.  This 
policy  MET  the  requirements  of  the  user's  manual:  "that  the 
five  enrollment  scans  taken  should  average  at  least  +0.  90.  " 
No  deviations  were  ever  allowed. 

In  addition,   the   swapping  of  template  data   located  in 
the  bubble   memories  of   the  DOT   and  DAISY  was  considered. 
This   to  assist   in  determining   the   cause  of   the  Type   II 
errors  'only'  occuring  on  the  DOT  7.5.   Refer  to  Table  7  for 
DAISY  Type   II  error   figures  i.e.,   (3   out  of   422).    The 
procedure   was  to   'download'   the   eye  templates   from  DOT 
bubble  memory   to  floppy   disk  using   the  '   BACK IB  BASIC   ' 
language  program  and   then  'upload'  to  DAISY  bubble  memory. 
Tests  would  be  run  and  then  the  procedure  reversed.  The  four 
subjects  would  try   to  get  false  acceptances   in  both  modes. 
It  was  never   done  because  in  the  interim,    the  three  false 
verifications( +0.  61, +0.  60, +0.  60)  occured  on  the  DAISY.   This 
enhanced   the   belief   that  some   similarities   between   eye 
patterns  were  evident  and   that  the  identification  threshold 
coefficient  would  have  to  be   permanently  raised  to  decrease 
the  probability  of  recurrent  Type  II  errors. 

A  floppy  disk  that  stored  the  hexadecimal  values  of  the 
eye  pattern  templates  belonging  to  the  four  (Type  II)  error 
subjects  was  forwarded  to  the  Eye-Dentify  Co.,  Oregon.  They 
were  able  to  investigate  and  compare  signatures  to  the 
bit( binary  digit-0,1)  level,  to  ascertain  how  similar  the 
eye  patterns   actually  were.   Verbal   reports  to   the  thesis 
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advisor   indicate    there   WERE   similarities   in    the   eye 
patterns. 
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IV.   COSTS/BENEFITS 


The  cost  of  the  Eye-dentify  7.  5  retinal  biometric 
scanner  is  $10,000.00  as  of  January  1986.  No  other  firm 
manufactures  such  a  product  and  the  U. S.  military  does  not 
own  or  maintain  this  type  of  device  aboard  ship.  They  are 
now  being  tested  by  research  facilities  like  the  Naval 
Postgraduate  School  for  possible  future  uses  by  the 
Department  of  Defense.  Because  there  is  a  lack  of 
competition  presently  between  manufacturers,  its  price  is 
relatively  expensive.  As  more  competitors  join  this  market 
though,  a  lower  equilibrium  price  should  eventually  be 
attained  for  retinal  scanner  hardware.  The  software  needed 
for  a  shipboard  computer  system  interface  would  depend  on 
the  size  of  the  application  required.  No  specific  price  is 
available,  because  retinal  scanner  applications  have  not 
been  developed  for  shipboard  use.  As  technology  is 
developed  though,  and  as  all  retinal  biometry  applications 
are  perfected,  this  price  should  decrease  also.  Numerous 
examples  of  products  from  the  computer  and  electronics 
industry  can  be  cited  to  support  this  claim.  The  most 
profound  is  the  advent  of  microcomputers.  When  the  LISA 
business  office  system  was  first  introduced  by  Apple 
Computer  Inc.  of  Cupertino,  California,  the  price  was 
$10,000.00.  In  a  very  short  time  prices  were  drastically 
cut(more  than  a  third).  This  was  due  to  intense  competition 
and  a  lack  of  market  interest  in  the  LISA.  Eventually  it  was 
discontinued  as  a  production  item. 

As  Research  and  Development R+D)  costs  are  distributed 
by  increasing  competition  and  amortized  over  increased  sales 
revenue  in  retinal  scanners,  the  unit  cost  of  each  machine 
should  decrease,   making  the   system  increasingly  affordable 
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and  attractive.  The  U. S.  Government  is  usually  the  first 
buyer  of  this  type  of  equipment  in  large  amounts.  This 
allows  the  private  sector  to  study  its  successes/failures 
through  government  use  before  they  have  to  buy  in  any 
quantity. 

1.   Applications 

Some  obvious  applications  aboard  ship  would  be 
security  and  access  control.  An  example  mentioned  earlier, 
would  be  to  locate  a  retinal  scanner  at  the  main  entrance  to 
the  nuclear  propulsion  space  on  either  an  aircraft 
carrier( CVN) ,  surface  combatant( CGN)  or  a 
submarine( SSN/SSBN) .  The  scanner  would  have  its  own  battery 
backup  for  emergency  power  generation  should  there  be  a  loss 
of  the  ship's  electrical  load.  If  it  was  decided  that  the 
scanner  alone  would  not  provide  adequate  security,  a 
password  system  or  cipher  lock  could  be  used  in  parallel 
with  the  scanner.  This  'double  protection'  system  has  more 
distinct  advantages  than  a  cipher  lock  or  password  system 
alone.  A  disadvantage  to  consider  is  the  additional  time 
required  to  successfully  gain  access  to  a  system  guarded 
with  'double  protection'. 
2.    Shortcomings 

Cipher  lock  combinations  can  be  compromised,  as  can 
passwords,  I.D's  etc.  Human  retina,  choroid  and  blood 
vessel  patterns  are  not,  as  long  as  the  database  manager( CRT 
lock)  is  honest  and  proficient.  This  manager(s)  is  the  only 
person(s)  with  the  capability  to  circumvent  via  the 
manipulation  of  parameters,  or  by  enrolling  someone  that 
does  not  have  authorization.  The  key  difference  is,  with 
passwords  everyone  with  access  must  MEMORIZE  it,  thereby 
having  the  ability  to  give  the  password  to  someone  else. 
With  retinal  scanning,  although  you  may  have  access,  you 
cannot  give  someone  else  your  eye  signature  template  stored 
away  in  bubble  memory. 
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Common  shortcomings  of  passwords  regarding  the 
security  of  a  computer  system  ,  especially  with  the  advent 
of  'hackers',  is  the  ability  to  control  the  dissemination  of 
the  password  and  the  need  to  constantly  change  it.  The  use 
of  retinal  identification  alleviates  this  need  because  the 
scanner  operates  as  a  secure  stand  alone  system  and  can  also 
be  installed  as  a  network  of  units  reporting  to  a  host 
computer.  ( Eye-Dentify,  1985)  It  could  be  used  to  simplify 
the  logon  procedure  for  a  computer  user.  Instead  of  typing 
the  user  ID  and  access  code,  the  user  simply  scans  and  gets 
logged  on  automatically. 

Certain  systems  needing  enhanced  security  might  only 
require  a  retinal  scanner  by  itself,  while  others  may  need 
double  protection  provided  through  'paralleling'.  Another 
option  to  consider  if  'paralleling'  is  not  feasible,  is  the 
use  of  one  machine  in  the  dual  eye  mode,  i. e. ,  (one  subject 
scanning  BOTH  left  and  right  eyes  simultaneously).  The  DAISY 
has  this  option,  the  DOT  does  not.  Also,  two  machines  can 
be  modified  so  that  the  correct  identification  of  two 
DIFFERENT  subjects  is  necessary  to  allow  access.  This 
technology  would  be  ideal  for  two  person  control  of  very 
sensitive  functions.  Envision  two  separate  7.5's  to  be  used 
by  watch  officers  in  a  missile  silo  to  scan  in  sequence 
before  their  system  could  be  activated. 

In  June  of  1981,  Columbia  Broadcast  System(CBS)  news 
aired  a  multi-faceted  evening  documentary  titled,  The 
Defense  of  the  United  States  .  In  one  episode,  viewers  were 
given  the  chance  to  explore  the  realm  of  a  watch  station  in 
a  nuclear  missile  silo.  The  officers  on  duty  had  certain 
procedures  to  be  followed  should  they  ever  receive  the  order 
from  the  President,  to  follow  through  with  what  they  were 
trained  to  do.  It  would  seem  reasonable  that,  with  the  use 
of  a  retinal  scanner  in  parallel  with  existing  activation 
procedures,   this  would  enhance   security.   This  would  occur 
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because  there  would  be  a  reduction  in  the  probability  that 
an  imposter  or  crazed  watchstander  could  successfully  breach 
all  authentication  procedures( now  to  include  a  retinal 
scanner),  gain  access  and  launch. 

To  estimate  the  total  cost  of  this  specific  piece  of 
HARDWARE  and  needed  peripherals  for  a  600  ship  Navy  and 
selected  Coast  Guard  vessels  is  beyond  the  scope  of  this 
thesis.  Some  ships  would  require  more  retinal  scanners 
because  the  equipment  they  store  and  the  information  they 
process  warrants  it.  Large  amounts  of  secure  information  are 
handled,  high  level  communication  and  computer  equipment 
must  be  guarded,  nuclear  spaces  protected  etc. ,  therefore 
more  scanners  are  needed.  Fewer  scanners  need  to  be 
installed  where  the  mission  of  the  vessel  does  not  include 
the  storage/dissemination  of  VAST  amounts  of  high  level 
secure  information,  equipment  or  computers. 

A  ship  classification  hierarchy  based  on  security 
requirements  would  need  to  be  developed  to  determine  how 
many  scanners  each  would  be  allocated.  Possible  groupings 
would  include:  all  nuclear  powered  combatants  and 
conventional  aircraft  carriers(  CVN, CV, SSN, SSBN, CGN) , 
conventionally  powered  combatants  large(CG,DD)  and 
small(DDG,FF,FFG) ,  the  auxiliary  force(  AO, AOE, AFS, AOR, AE ) . 
Others  are  the  amphibious  force  large( LHA, LPH, LKA)  and 
small( LST,LSD,LPD) ,  command  and  control( LCC,MSC) , 
battleships( BB)  and  support  tenders  (AD,AR,AS).  Coast  Guard 
cutter  groupings  would  be  High  Endurance  Cutter s( WHEC) , 
Medium  Endurance  Cutter s( WMEC)  and  Icebreakers( WAGB) . 

Additional  costs  would  include  needed  maintenance 
beyond  contracted  warranty.  Also  application  software  costs 
for  the  particular  requirements  at  hand,  would  be  quite 
considerable. 
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V.   CONCLUSIONS 

In  general,  the  use  of  this  device  is  ONLY  acceptable 
when  the  physical  security  of  the  space  will  preclude  access 
via  any  other  means.  Cost  is  always  a  consideration.  It 
would  appear  a  fairly  minor  one  in  this  instance,  given  the 
sensitive  data,  information  and  equipment  a  scanner  would 
assist  in  protecting.  This  opinion  is  enhanced  by  the 
recent  spying  cases  under  investigation  throughout  the 
United  States  Navy  and  other  government  agencies.  A  recent 
Navy  spy  case  involves  a  Navy  civilian  counterintelligence 
analyst,  and  his  wife.  He  for  allegedly  spying  for  our  ally 
Israel,  and  his  wife  charged  with  relaying  top  secret  data 
to  Red  China.  Non-Navy  employees  arrested  include  a  man  who 
was  convicted  of  selling  CIA  information  to  Chinese 
intelligence  agents  for  more  than  thirty  years.  Another  man 
is  charged  with  delivery  and  attempting  to  deliver  national 
defense  documents  to  an  adversary.  One  document  was  a 
transcript  of  a  hearing  of  the  House  Armed  Services 
Committee  classified  as  top  secret. 

The  need  for  enhanced  security  is  understandable.  It 
must  be  noted  though,  that  with  retinal  biometrics  along 
with  the  other  biometric  devices(  fingerprint, palmprint, 
finger  length  etc.  ),  the  human  element  is  still  relied  upon. 
Human  systems  cannot  be  considered  infallible  when  a  CRT 
database  administrator  is  capable  of  being  careless  or 
dishonest  when  enrolling  individuals.  Money  can  still  be 
used  as  a  bribe  to  circumvent  the  system.  With  this  system 
though,  fewer  individuals  have  access  to  controls  which 
could  make  a  difference. 
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A.   USES  ABOARD  SHIP 

In  an  area  aboard  ship  requiring  maximum  security,  with 
a  limited  number  of  people  requiring  access  IMMEDIATELY,  the 
retinal  biometric  measuring  device  would  be  ideal.  It  should 
provide  a  more  reliable  method  of  identification  than  a 
photograph,  ID,  cipher  or  password  because  it  cannot  be 
compromised  as  readily.  Its  use  could  also  be  considered 
aboard  ship,  where  the  total  access  list  is  small  to  medium 
in  number,  immediate  access  is  NOT  so  critical,  and  entry 
times  are  STAGGERED  to  alleviate  the  chance  of  a  queue 
forming.  During  an  alarm,  certain  individuals  such  as  the 
commanding  officer  might  have  to  bypass,  if  possible,  for 
immediate  access.  The  greater  the  number  of  subjects  needing 
access  to  a  space  or  system  in  a  shipboard  application,  the 
greater  the  possibility  that  large  queues  might  form.  This 
would  be  counterproductive. 

Physical  maintenance  of  the  7.  5  should  not  be  a  concern. 
The  system  is  compact,  and  capable  of  being  mounted  on  a 
table  top  or  protruding  from  a  bulkhead.  It  would  be  treated 
like  any  other  valuable  electronic  equipment;  located  within 
the  interior  of  the  ship  away  from  the  elements,  i.e. , 
salt/sea  spray,  extreme  temperatures  etc. .  There  would  be  a 
need  for  software  maintenance  as  updates  are  needed. 

Although  costs  and  benefits  were  discussed  in  the  prior 
chapter,  it  was  not  a  comprehensive  investigation,  but  only 
a  general  overview.  It  is  beyond  the  scope  of  this  thesis  to 
dissect  the  subject  any  further.  An  entire  thesis  could  be 
dedicated  to  a  cost/benefit  analysis  of  installing  retinal 
biometric  scanners  aboard  U.  S.  Navy  ships  and  Coast  Guard 
cutters. 

Retinal  scanners  should  become  commonplace  in  future 
years.  Individuals  will  want  to  know  the  long  term  effects 
of  exposure  to  the  infrared  light.   Although  Threshold  Limit 
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Testing(TLV)  has  shown  the  effect  to  be  harmless,   many  will 
still  continue  to  be  concerned. 
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